From 7c32657002fca2c7e2195d789b1b11e3071d79a2 Mon Sep 17 00:00:00 2001 From: Gabriel Schneider Date: Thu, 26 Mar 2026 16:23:24 -0300 Subject: Squashed older blog files --- trees/blog/archive/umdctf-2024-donations-fixed.md | 24 +++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 trees/blog/archive/umdctf-2024-donations-fixed.md (limited to 'trees/blog/archive/umdctf-2024-donations-fixed.md') diff --git a/trees/blog/archive/umdctf-2024-donations-fixed.md b/trees/blog/archive/umdctf-2024-donations-fixed.md new file mode 100644 index 0000000..7f8df33 --- /dev/null +++ b/trees/blog/archive/umdctf-2024-donations-fixed.md @@ -0,0 +1,24 @@ +--- +title: "umdctf2024 - Donations Fixed" +date: 2024-04-28T19:18:00-03:00 +draft: false +description: "" +tags: ["web", "ctf"] +--- + + +This is the harder version of [donations](/writeups/umdctf-2024-donations-fixed), it's the same challenge, but you can't donate negative amounts this time. + +After playing with it for a while, I realized that the solution was probably to find a way to donate money to your user, bypassing that Jeff Bezos check. So I tested adding more user id's in the `to` parameter and the money went to them. + +So the solution was to create users, and donate all of their money to a user which will retrieve the flag. + +```http +POST /api/donate HTTP/2 +Host: donations2-api.challs.umdctf.io +Cookie: session=... +Content-Length: 36 +Content-Type: application/x-www-form-urlencoded + +to=lisanalgaib&to=gbrls¤cy=999 +``` -- cgit v1.3